GRC - ECC Integration doubt

[madhusap]

Hi Gurus,

Need experts advise.

Our ECC system is connected to GRC 10. Workflows are working fine. Role design is based on Master-Derived roles concept.

Now on the same ECC another client also implementing one module. They will also connect to same GRC 10 system.

Since both our roles and their roles exist on same ECC system can they use the workflows which we have already designed and working fine for GRC as client confirmed workflow approach would be the same for all roles in ECC ?

ECC system [ Roles designed by our Team + Roles designed by another client]

GRC 10 system [workflows designed by our team + Other client can they use same workflows [since scenarios and stages and path are same]]

* Confusion because single system is being shared by two clients Separately for implementation

Regards,

Madhu.

[Colleen · Accepted solution]

HI Madhu

Summarising your situation:

• There is a single ECC system
• There is a single GRC System
• The two systems are already integrated
• There are two clients/groups of security administrations/business groups/etc
• One group is already on the GRC System
• You want to add the second group

What I'm unsure of is what functionality are you using in GRC AC?

can they use the workflows which we have already designed and working fine

Trying to answer your question: although you say your workflows are working, being able to use them without modification will depend on how they are design. For example:

• If you have a access approval and the agents are Manager and Role Owner then you just need to add the second group's managers and update their roles with their owns - no changes to your configuration
• If you have a scenario when you route the request based on a certain attribute to a specific team who will not be responsible for group 2 then you would need to change your rule results for the initiator rule to factor in routing scenarios for the group 2 (if this is confusing I'll attempt a clarification)

What you also need to consider:

• configuration for naming conventions and your role methodology (if you are using BRM) - especially if you have enforced your role naming convention for group 1 but it conflicts for group 2
• security access to segregate role management (assuming you separate access between the two teams in PFCG)
• setting up the approvers, access control owners, etc
• impacts to any escalation on Workflows, etc
• Is there a possibility to two groups may need to have different WF requirements later on (if so, create an initiator rule that determines which group/client they are and keep the paths separate from each.

Short answer: yes the can but it really depends on what your configuration is for Agent Rules so you can route to another approver.

Regards

Colleen

[madhusap · Accepted solution]

Hi Colleen,

Thanks for clearly explaining the impact. I understood completely now. One more doubt is if there are two workflows, say Create New Account, with different paths in the same system will it be any issue?

If workflow stages and paths are same like Manager (1st stage), Role Owner (2nd stage) then we can reuse the existing workflows right?

Regards,

Madhu.

[Colleen · Accepted solution]

Hi Madhu

I think I answered your clarification already....

Let's be clear - it is the same workflow (workflow, tasks, etc). You need to decide if you can use your MSMP configuration AS-IS or if you need to make changes

If you are just using Manager and Role Owner then you probably won't need further maintenance of MSMP assuming you've used the default Agent Rules. But you need to confirm this and not take my answer as: yes leave as is.

Regards

Colleen

[madhusap · Accepted solution]

Thanks Colleen. I got your point.

Actually the other team wants to know whether they can use our workflows. I have clarified with them based on the inputs provided by you.

We advised the other client not to use the same workflow, so i think there won't be any problem right if they create their own workflows with different paths for Create Account, Change Account unless all of them have same stages and agents?

Thanks a lot for your guidance and support.

Regards,

Madhu.

[Colleen · Accepted solution]

We advised the other client not to use the same workflow, so i think there won't be any problem right if they create their own workflows with different paths for Create Account, Change Account unless all of them have same stages and agents?

That's fine - but remember "not use the same workflow" from a configuration point of view is still the same "workflow'. You will need to change your initiator rule to come up with new scenarios to split at the beginning. If you do that first, then you can isolate the paths for the two groups and they won't impact each other when they want to change. However, any changes would always need to be tested by both groups to just to be sure.

Glad to hear you were able to clarify issues with the teams.

[madhusap · Accepted solution]

Thanks Colleen. We will set up one scenario in development environment, once the other client decides on their workflow scenario, will test and confirm.

Basic doubts which i had in mind were cleared now. Thanks a lot for your support.

Regards,

Madhu.